Read the docs
TI-2020-11233 Aliases CVE-2020-14365GHSA-m429-fhmv-c6q2

Improper signature verification in ansible

Priority LOW 31CWE-347Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 6 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Why it matters now

EPSS 0.00233 14th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.8.15, 2.9.13Red Hat: 3 advisoriesRed Hat: 6 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ansibleansible-engine 2.8.15, ansible-engine 2.9.13—No fix listedCNA
—ansible (PyPI)2.8.0a1 to before 2.8.152.8.15Patch availableGHSA-m429-fhmv-c6q2
—ansible (PyPI)2.9.0a1 to before 2.9.132.9.13Patch availableGHSA-m429-fhmv-c6q2
  • ansible Vendor— Affected ansible-engine 2.8.15, ansible-engine 2.9.13 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.15 Fixed in 2.8.15 Patch available GHSA-m429-fhmv-c6q2
  • ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.13 Fixed in 2.9.13 Patch available GHSA-m429-fhmv-c6q2

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*2.8.0 – 2.8.15; 2.9.0 – 2.9.13VulnerableRed Hat
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*3.6.0 – 3.6.5; 3.7.0 – 3.7.2VulnerableRed Hat
cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack_platform:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*13.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* Versions 2.8.0 – 2.8.15; 2.9.0 – 2.9.13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* Versions 3.6.0 – 3.6.5; 3.7.0 – 3.7.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack_platform:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-m429-fhmv-c6q2 ansible (PyPI) Fixed in 2.8.15 Advisory →
  • Fix · GHSA-m429-fhmv-c6q2 ansible (PyPI) Fixed in 2.9.13 Advisory →

Red Hat 3 advisories

  • RHSA-2020:3602 Released 2020-09-01 · Red Hat rating Important
    Ansible security and bug fix update (2.9.13)
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.13-1.el7ae, ansible-test-2.9.13-1.el7ae
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.13-1.el8ae, ansible-test-2.9.13-1.el8ae
  • RHSA-2020:3601 Released 2020-09-01 · Red Hat rating Important
    Ansible security and bug fix update (2.9.13)
    • Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.13-1.el7ae, ansible-test-2.9.13-1.el7ae
    • Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.13-1.el8ae, ansible-test-2.9.13-1.el8ae
  • RHSA-2020:3600 Released 2020-09-01 · Red Hat rating Important
    Ansible security and bug fix update (2.8.15)
    • Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.15-1.el7ae
    • Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.15-1.el8ae

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Tower 3AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2020:3602
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2020:3602
Red Hat Ansible Engine 2.8 for RHEL 7 ServerFixed RHSA-2020:3600
Red Hat Ansible Engine 2.8 for RHEL 8Fixed RHSA-2020:3600
Red Hat Ansible Engine 2.9 for RHEL 7 ServerFixed RHSA-2020:3601
Red Hat Ansible Engine 2.9 for RHEL 8Fixed RHSA-2020:3601

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14365
  2. 2026-10-03 Alias added: GHSA-m429-fhmv-c6q2

References

Advisory 4

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences